high7.5Public exploit code
CVE-2006-3280
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag wit…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Internet Explorer 5.0.1 - OuterHTML redirection Handling Information Disclosure2006-06-27 · remote · windows · Verified
Impact
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Internet Explorer | Version 6.0 |
References
- NVD record
- CVE.org record
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047398.html
- http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060627/3d930eda/PLEBO-2006.06.16-IE_ONE_MINOR_ONE_MAJOR.obj
- http://secunia.com/advisories/20825
- http://secunia.com/advisories/21396
- http://secunia.com/internet_explorer_information_disclosure_vulnerability_test
- http://securitytracker.com/id?1016388
- http://www.kb.cert.org/vuls/id/883108
- http://www.securityfocus.com/archive/1/438785/100/0/threaded
- http://www.securityfocus.com/archive/1/438788/100/0/threaded
- http://www.securityfocus.com/archive/1/438811/100/0/threaded
- http://www.securityfocus.com/archive/1/438863/100/0/threaded
- http://www.securityfocus.com/archive/1/438864/100/0/threaded
- http://www.securityfocus.com/archive/1/439146/100/0/threaded
- http://www.securityfocus.com/bid/18682
- http://www.us-cert.gov/cas/techalerts/TA06-220A.html
- http://www.vupen.com/english/advisories/2006/2553
- http://www.vupen.com/english/advisories/2006/3212
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27452
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A738
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047398.html
- http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060627/3d930eda/PLEBO-2006.06.16-IE_ONE_MINOR_ONE_MAJOR.obj
- http://secunia.com/advisories/20825
- http://secunia.com/advisories/21396
- http://secunia.com/internet_explorer_information_disclosure_vulnerability_test